This article describes the steps to solve the Web-Card task designed for CTFZone 2019. The task is a kind of tribute to the XML format and contains a 0-day (as of the competition dates), an unusual way to exploit XXE and a remarkable chain of vulnerabilities. This write-up was drafted…

By Roman Shemyakin Part I: CTFZone Paper: Trust Area — Backend Part Part II: CTFZone Paper: Trust Area — Client Part Apps bootstrap We had an emulator and a clean snapshot. Every round, we did a reset to the initial ‘clean’ state and installed the teams’ applications. We grabbed the teams’ APK…

By Oleg Petrakov Part I: CTFZone Paper: Trust Area — Backend Part Part III: CTFZone Paper: Trust Area — Infra About application architecture The primary task of the Android client was to proxy the calls from other clients in the emulator, including the checker, to the team’s respective backend server. …

By Arkadiy Litvinenko Part II: CTFZone Paper: Trust Area — Client Part Part III: CTFZone Paper: Trust Area — Infra Introduction We had long aspired to create a task for attack-defense CTF competitions involving the detection and exploitation of vulnerabilities in Android-powered mobile applications. However, we had many doubts concerning the…

By Innokentii Sennovskii It’s widely known that the best way to make a student study a boring subject is to transform learning into a game. A long time ago someone came up with a game of this sort in the field of Cybersecurity — Capture the Flag or CTF for…

Hey, Medium! Interesting times we are living in: deepfakes, trade wars, political games, Greta (bless her) Thunberg, and if that wasn’t enough for you, have some fun with the coronavirus infection COVID-19. The coronavirus pandemic has also taken its toll on our Conference on Practical Cybersecurity OFFZONE 2020. …

Despite the postponement of the OFFZONE 2020 conference, there will be a CTFZone final! This year it will be held online for the first time and will be actively broadcast on social networks. We will announce the details later, but for now we suggest reviewing the web-task write-up from the…

The third international conference on practical cybersecurity OFFZONE 2020 is just 71 days away. While the organisation of the event is in full swing, the attendees are welcome to kill the wait with some fun activities. …

Writeup “In the Shadows” This is a writeup on one of the tasks prepared for the CTFZone qualifying stage, that took place in late November. You can also read about how we organized the qualifying stage as a whole in this story. You start with two files: decrypt_flag.py and ntfs_volume.raw. …